CVE-2026-61575
MediumCVSS 4.7Summary
Prior to 8.1.0, AVideo's view/queue.php uses pathinfo on the caller-controlled fileURI and stores its filename through setTitle in encoder_queue.title without neutralization. fileURI is not covered by the objects/security.php filter lists, and the Login::canUpload() capability can be self-granted, allowing an attacker to store an HTML title whose event handler runs in a privileged viewer's browser (an administrator or an operator on the attacker's streamer).
Risk Assessment
An authenticated attacker can execute arbitrary JavaScript in a privileged user's context, read session data and rendered streamer credentials, and act with the viewer's privileges. The script can execute again for each qualifying viewer until the row is removed.
Recommendation
Upgrade AVideo to version 8.1.0 or later. Restrict self-granting of the canUpload capability and verify that queue titles are encoded before being inserted into HTML.
Other vulnerabilities in AVideo
See all- CVE-2026-61573Medium
Prior to 8.1.0, AVideo's anonymous login interface reflects request values into HTML and JavaScript without output encoding. webSiteRootURL is returned verbatim by Streamer::getStreamerURL() and reaches navigation and form attributes as well as a JavaScript string in view/index.header.php, while the user and pass fields are filtered only for single quotes, allowing double quotes and angle brackets to break out of HTML attributes. Additionally, view/index.header.php reflects POST fields using json_encode without JSON_HEX_TAG, and locale/function.php stores the POST lang value in the session for unescaped reflection.
- CVE-2026-61572High
An SSRF vulnerability in AVideo (before version 8.1.0) allows an unauthenticated remote attacker to read responses from internal HTTP/HTTPS and FTP services. The `url_get_contents` function does not reject private, loopback, or link-local addresses and disables TLS peer verification, while the `objects/login.json.php` endpoint returns the fetched body. Additionally, `view/youtubeDl.json.php` enables requests to internal FTP servers.
- CVE-2026-61571High
In AVideo before 8.1.0, the encoder lacks a global authentication layer and exposes control and status PHP endpoints to anonymous network callers. The endpoints `view/run.php`, `view/queue.json.php`, `view/status.php`, and `view/listFiles.json.php` allow an unauthenticated attacker to drive the privileged queue processor, read queue and streamer-site information, obtain memory statistics, and enumerate media file names and paths in any directory readable by the web-server user. This is fixed in version 8.1.0.
- CVE-2026-61569High
In AVideo before 8.1.0, the unauthenticated streamer login at `objects/login.json.php` passes the `user` parameter to `Streamer::get`, where it is interpolated into a single-quoted MariaDB SELECT without parameterization or escaping. Although `objects/security.php` strips literal single quotes, `html_entity_decode` in `objects/Login.php` restores entity-encoded quotes before the query. UNION results are exposed through `streamers_id`, while failures return the rendered query and MariaDB error. This is fixed in version 8.1.0.
- CVE-2026-89255High
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to HTML-encode PGP public keys echoed into a textarea element. An authenticated attacker can inject malicious JavaScript by submitting a crafted public key, which executes in an administrator's session when viewing the user's profile tab.
- CVE-2026-89253High
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile field. User::setDonationLink() stores the value and save() validates it only with filter_var(..., FILTER_VALIDATE_URL), which accepts strings such as http://evil.example/"onmouseover=alert(document.domain)//, while getDonationLink() applies only strip_tags() and does not encode double quotes. An authenticated user who updates their own profile can break out of the href attribute and inject an event handler that executes JavaScript in the browser of any visitor, including an administrator.
- CVE-2026-89250High
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an unauthenticated file read vulnerability in the getRecordedFile.php endpoint that streams recorded FLV files from the temporary directory. Attackers can request the endpoint with a known or guessed stream key to download recorded live video files without authentication or authorization checks.
- CVE-2026-89248Medium
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is missing an authentication/authorization check in plugin/WebRTC/status.json.php. When the WebRTC plugin is present, any unauthenticated remote user can request the endpoint and receive JSON containing the absolute filesystem path of the WebRTC2RTMP helper binary, the configured WebRTC port, file_exists/is_executable status, log contents, and port reachability information.
- CVE-2026-89245Medium
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in playlistRemove.php that allows attackers to delete playlists by skipping CSRF protection checks. Attackers can craft a malicious form that submits a POST request to playlistRemove.php.
- CVE-2026-89240Medium
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Live/confirmLivePassword.php. The unauthenticated GET parameter u is interpolated directly into an img src attribute without URL- or HTML-encoding, allowing injection of an additional tag with an onerror handler.
Original NVD description (English source)
AVideo is a video-sharing Platform. Prior to 8.1.0, `view/queue.php` uses `pathinfo` on the caller-controlled `fileURI` and stores its filename through `setTitle` in `encoder_queue.title` without neutralization. `fileURI` is not in the `objects/security.php` filter lists, and the `Login::canUpload()` capability needed to submit a queue entry can be self-granted using an attacker-controlled login site without legitimate encoder credentials. `view/index.php` loads `queue.json` from `view/queue.json.php` into the `#grid` jQuery Bootgrid table; its title formatter concatenates `row.title` into raw cell HTML. An attacker can therefore store an HTML title whose event handler runs in a privileged viewer's browser. `Encoder::getAll` limits nonadministrators to their own streamer's rows, so the victim must be an administrator who sees all rows or an operator on the attacker's streamer. A second `.html()` sink in the progress panel uses the same title but additionally depends on a helper script loaded from the streamer; the Bootgrid sink is reachable from encoder code alone. The script can read session-visible data and rendered streamer credentials, act with the viewer's privileges, and execute again for each qualifying viewer until the row is removed. This issue is fixed in version 8.1.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS